Meta has rejected claims that its Muse AI agent could read a user’s Messages on a Mac without consent, saying the feature works only if the user turns on the required permissions.
Andy Stone, Meta’s head of communications, wrote on X on Wednesday that Muse’s Messages integration on Mac is "entirely opt-in." He said the app cannot read a user’s Messages unless that person enables the necessary settings, and added that access can be revoked at any time.
According to Stone, two switches must be turned on. One is Full Disk Access, an Apple macOS setting that allows an app to read files across a computer. The other is the Messages connector inside Muse itself. Stone said both settings can be disabled at any time.
A report from Jason Aten triggered the dispute
Stone’s response came after AppleInsider reported on the experience of Inc. columnist Jason Aten, who said Muse uploaded his texts to the cloud despite his permission settings.
Muse is positioned by Meta as a personal AI agent, software meant not only to answer questions but also to take actions on a user’s behalf, such as sending an email or booking travel. Meta launched Muse on Sept. 8, and the app had passed 2.5 million downloads by Sept. 23.
Meta developed Muse inside Superintelligence Labs, its AI research unit. The lab’s first model, Muse Spark, was released on April 8.
Aten installed Muse on an iPhone and a Mac mini. He said he declined to grant message access during setup, and later checked again to confirm that Full Disk Access was off.
He then said Muse proposed a column idea based on a private text conversation with his podcast co-host. It also flagged a message from his editor about a deadline.
When Aten asked how Muse knew that information, the app said it had only seen the pop-up notification banners for incoming messages. Aten said that explanation was not true. He said he later found that Muse had synced his local Messages database, the file on a Mac that stores text history.
Meta says Muse’s notification explanation was incorrect
David Singleton, who leads Meta Superintelligence Labs, said Muse’s explanation about notifications was wrong. He said the app syncs Messages data when Messages access is enabled.
Singleton also said that reading Messages requires three separate permission steps, and that macOS protections cannot be bypassed even if the Muse app had a bug.
Aten’s account and Meta’s position remain in direct conflict. Aten said Full Disk Access was off on his machine and the texts were synced anyway. Meta said Muse cannot read Messages without that setting.
Why the permission toggle matters
The dispute reaches beyond a single app setting. An AI agent can act only with the access a user gives it, which puts the permission screen at the center of the issue. Text messages can include family conversations as well as verification codes sent by banks.
The clash is also not limited to Meta. Amazon began blocking Muse on Sept. 21, saying the agent does not identify itself while browsing and appears to capture customer credentials. Meta said Muse has no visibility into passwords or payment methods.
Amazon has already won an early round in a similar dispute. On March 10, a federal judge granted a preliminary injunction blocking Perplexity’s Comet from making purchases on Amazon for users while the case proceeds.